MedusaLocker

MedusaLocker is a potent malware, first observed in 2019, that primarily targets the healthcare sector. It operates as a Ransomware-as-a-Service (RaaS), often using the double extortion method for monetary gain. This ransomware has been particularly effective during periods of disorder and confusion such as the COVID-19 pandemic, according to a February 2023 report by the US Department of Health and Human Services. MedusaLocker should not be confused with another similarly named RaaS, Medusa, which was first observed in 2021. A new variant of MedusaLocker was discovered by PCrisk, which appends the .crypto1317 extension and drops a ransom note named How_to_back_files.html. Like other ransomware, it terminates specific services by referencing a hardcoded list of services. This variant uses the same chat and leak site URLs as the original MedusaLocker ransomware. The Medusa group's RaaS platform, different from the original MedusaLocker, has been active since late 2022. The threat posed by MedusaLocker extends globally, with organizations being targeted by financially motivated threat actors. Cisco Talos analysis found instances of staggering $5 million ransom demands. The tool has been used by various ransomware operations, including AvosLocker, BlackCat, Trigona, and LockBit. These strains reflect global trends seen in Singapore's threat landscape, where LockBit, DeadBolt, and MedusaLocker are among the common models deployed.